Isn't it also something you know? They mention that using passkeys usually requires unlocking a password manager, so presumably they're encrypted at rest